Temporary Service Interruption for Crush Due to Critical 0 Day

Update timeline

1. resolved Jul 18, 2025, 03:30 PM UTC

   A critical zero-day vulnerability has been identified in Crush. While there are currently no indications that this vulnerability has been exploited, we are taking proactive steps to protect your data by disabling the Web Portal. SFTP access and automated jobs remain unaffected at this time. We will begin patching at 6:00 PM EST on July 18, 2025. During this maintenance, all Crush services — including SFTP and automated jobs — will be unavailable for approximately 1 hour. We will restore all services as soon as the update is successfully applied.

2. investigating Jul 18, 2025, 03:30 PM UTC

   A critical zero-day vulnerability has been identified in Crush. While there are currently no indications that this vulnerability has been exploited, we are taking proactive steps to protect your data by disabling the Web Portal. SFTP access and automated jobs remain unaffected at this time. We will begin patching at 6:00 PM EST on July 18, 2025. During this maintenance, all Crush services — including SFTP and automated jobs — will be unavailable for approximately 1 hour. We will restore all services as soon as the update is successfully applied.

3. resolved Jul 18, 2025, 09:03 PM UTC

   As the security of your data is our top priority, our dedicated security team and 24/7 monitoring tools continuously safeguard our servers against potential threats. In addition to our normal security procedures, we have engaged directly with CrushFTP Support. Based on the indicators of compromise provided by CrushFTP, we have thoroughly reviewed this server and have found no evidence that the server was compromised or that any data was impacted in any way. The Trimble Transportation Cloud Services Operations Team will be applying the security patch at 6:00 PM EST on July 18, 2025. During this maintenance window, all CrushFTP services — including the Web Portal, SFTP access, and automated jobs — will be unavailable. We expect to have all CrushFTP services fully restored by 7:00 PM EST. We will continue to monitor and work closely with CrushFTP to ensure your data remains secure.

4. investigating Jul 18, 2025, 09:03 PM UTC

   As the security of your data is our top priority, our dedicated security team and 24/7 monitoring tools continuously safeguard our servers against potential threats. In addition to our normal security procedures, we have engaged directly with CrushFTP Support. Based on the indicators of compromise provided by CrushFTP, we have thoroughly reviewed this server and have found no evidence that the server was compromised or that any data was impacted in any way. The Trimble Transportation Cloud Services Operations Team will be applying the security patch at 6:00 PM EST on July 18, 2025. During this maintenance window, all CrushFTP services — including the Web Portal, SFTP access, and automated jobs — will be unavailable. We expect to have all CrushFTP services fully restored by 7:00 PM EST. We will continue to monitor and work closely with CrushFTP to ensure your data remains secure.

5. resolved Jul 18, 2025, 09:45 PM UTC

   The Trimble Transportation Cloud Services Operations Team will be applying the security patch in 15 minutes, at 6:00 PM EST on July 18, 2025. During this maintenance window, all CrushFTP services — including the Web Portal, SFTP access, and automated jobs — will be unavailable. We expect to have all CrushFTP services fully restored by 7:00 PM EST.

6. in progress Jul 18, 2025, 09:45 PM UTC

   The Trimble Transportation Cloud Services Operations Team will be applying the security patch in 15 minutes, at 6:00 PM EST on July 18, 2025. During this maintenance window, all CrushFTP services — including the Web Portal, SFTP access, and automated jobs — will be unavailable. We expect to have all CrushFTP services fully restored by 7:00 PM EST.

7. resolved Jul 18, 2025, 10:20 PM UTC

   The security patches addressing the recently identified CrushFTP vulnerability have been successfully applied. All CrushFTP services — including the Web Portal, SFTP access, and automated jobs — have been fully restored and are operating normally. At this time, we have no indication that this vulnerability was exploited. Thank you for your understanding and cooperation as we worked to ensure the security of your data. If you have any questions or encounter any issues, please reach out to our support team. For ongoing updates, please visit status.tmwcloud.com.

8. resolved Jul 18, 2025, 10:20 PM UTC

   The security patches addressing the recently identified CrushFTP vulnerability have been successfully applied. All CrushFTP services — including the Web Portal, SFTP access, and automated jobs — have been fully restored and are operating normally. At this time, we have no indication that this vulnerability was exploited. Thank you for your understanding and cooperation as we worked to ensure the security of your data. If you have any questions or encounter any issues, please reach out to our support team. For ongoing updates, please visit status.tmwcloud.com.